CVE-2008-2119 Null dereference in n/a
Remote attackers can crash the Asterisk daemon via a malformed SIP INVITE message when pedantic parsing is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-2119?
CVE-2008-2119 is a medium-severity vulnerability in n/a, published on 4 Jun 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer.
Weakness: CWE-20
Which versions are affected by CVE-2008-2119?
It affects 2 products.
Products include Asterisk Asterisk Business Edition, Asterisk Open Source.
How do I fix CVE-2008-2119?
Upgrade to a fixed version.
Is CVE-2008-2119 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-2119 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2008-2119, GHSA-rh4w-35r5-ffvh.